diff --git a/src/test/java/de/ids_mannheim/korap/web/service/full/KustvaktServerTest.java b/src/test/java/de/ids_mannheim/korap/web/service/full/KustvaktServerTest.java
index aa99ac9..0226217 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/full/KustvaktServerTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/full/KustvaktServerTest.java
@@ -55,105 +55,184 @@
 import de.ids_mannheim.korap.utils.JsonUtils;
 
 /**
- * This class tests services of a running Kustvakt server with a MySQL database.
- * Please check the database configuration in src/main/resources/jdbc.properties
+ * This class tests services of a running Kustvakt server with a MySQL
+ * database.
+ * Please check the database configuration in
+ * src/main/resources/jdbc.properties
  * and run the server before running the tests.
  * 
- * See {@link ResourceServiceTest} for tests using an in-memory database.
+ * See {@link ResourceServiceTest} for tests using an in-memory
+ * database.
  * 
  * @author margaretha
  *
  */
 public class KustvaktServerTest extends BeanConfigTest {
-	@Test
-	public void testCreatePolicy() throws IOException, URISyntaxException {
-		
-		HttpClient httpClient = HttpClients.createDefault();;
-		
-        String id = UUID.randomUUID().toString();
-		URIBuilder builder = new URIBuilder();
-		builder.setScheme("http")
-			.setHost("localhost")
-			.setPort(8089).setPath("/api/v0.1/admin/createPolicies/" + id)
-			.setParameter("type", "virtualcollection")
-			.setParameter("name", "Goethe VC")
-			.setParameter("description", "Goethe corpus")
-			.setParameter("group", "public")
-			.setParameter("perm", Permission.READ.name())
-			.setParameter("loc", "")
-			.setParameter("expire", "");
+    @Test
+    public void testCreatePolicy () throws IOException, URISyntaxException {
 
-		URI uri = builder.build();
-		HttpPost httppost = new HttpPost(uri);
-		
-		httppost.addHeader(Attributes.AUTHORIZATION, BasicHttpAuth.encode("kustvakt", "kustvakt2015"));
-		HttpResponse response = httpClient.execute(httppost);
-		assertEquals(ClientResponse.Status.OK.getStatusCode(),
+        HttpClient httpClient = HttpClients.createDefault();;
+
+        String id = UUID.randomUUID().toString();
+        URIBuilder builder = new URIBuilder();
+        builder.setScheme("http").setHost("localhost").setPort(8089)
+                .setPath("/api/v0.1/admin/createPolicies/" + id)
+                .setParameter("type", "virtualcollection")
+                .setParameter("name", "Goethe VC")
+                .setParameter("description", "Goethe corpus")
+                .setParameter("group", "public")
+                .setParameter("perm", Permission.READ.name())
+                .setParameter("loc", "")
+                .setParameter("expire", "");
+
+        URI uri = builder.build();
+        HttpPost httppost = new HttpPost(uri);
+
+        httppost.addHeader(Attributes.AUTHORIZATION,
+                BasicHttpAuth.encode("kustvakt", "kustvakt2015"));
+        HttpResponse response = httpClient.execute(httppost);
+        assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatusLine().getStatusCode());
 
-	}
+    }
 
-	@Test
-	public void testWrongAuthorization() throws IOException, URISyntaxException {
-		HttpResponse response = testResourceStore("wezrowerowj");
-		assertEquals(ClientResponse.Status.UNAUTHORIZED.getStatusCode(), response.getStatusLine().getStatusCode());
-	}
 
-	@Test
-	public void testCorrectAuthorization() throws IOException, URISyntaxException, KustvaktException {
+    @Test
+    public void testCreatePolicyForFoundry ()
+            throws IOException, URISyntaxException {
 
-		HttpResponse response = testResourceStore("kustvakt2015");
-		HttpEntity entity = response.getEntity();
-		String content = null;
+        HttpClient httpClient = HttpClients.createDefault();;
 
-		if (entity != null) {
-			InputStream is = entity.getContent();
-			try {
-				content = IOUtils.toString(is, "UTF-8");
-			} finally {
-				is.close();
-			}
-		}
+        String id = UUID.randomUUID().toString();
+        URIBuilder builder = new URIBuilder();
+        builder.setScheme("http").setHost("localhost").setPort(8089)
+                .setPath("/api/v0.1/admin/createPolicies/" + id)
+                .setParameter("type", "foundry")
+                .setParameter("name", "stanford")
+                .setParameter("description", "stanford parser")
+                .setParameter("group", "public")
+                .setParameter("perm", Permission.READ.name())
+                .setParameter("loc", "255.255.255.0")
+                .setParameter("expire", "30D");
 
-		assertEquals(ClientResponse.Status.OK.getStatusCode(), response.getStatusLine().getStatusCode());
+        URI uri = builder.build();
+        HttpPost httppost = new HttpPost(uri);
 
-		JsonNode node = JsonUtils.readTree(content);
-		assertNotNull(node);
-		assertTrue(node.isObject());
-		assertEquals("Goethe", node.path("name").asText());
-		assertEquals("Goethe corpus", node.path("description").asText());
+        httppost.addHeader(Attributes.AUTHORIZATION,
+                BasicHttpAuth.encode("kustvakt", "kustvakt2015"));
+        HttpResponse response = httpClient.execute(httppost);
+        assertEquals(ClientResponse.Status.OK.getStatusCode(),
+                response.getStatusLine().getStatusCode());
 
-		// checkResourceInDB(node.path("id").asText());
-	}
+    }
 
-	public HttpResponse testResourceStore(String password) throws IOException, URISyntaxException {
 
-		HttpClient httpclient = HttpClients.createDefault();
-		URIBuilder builder = new URIBuilder();
-		builder.setScheme("http").setHost("localhost").setPort(8089).setPath("/api/v0.1/virtualcollection")
-				.setParameter("filter", "httpclient").setParameter("name", "Goethe")
-				.setParameter("description", "Goethe corpus");
-		URI uri = builder.build();
-		HttpPost httppost = new HttpPost(uri);
-		httppost.addHeader(Attributes.AUTHORIZATION, BasicHttpAuth.encode("kustvakt", password));
-		return httpclient.execute(httppost);
+    @Test
+    public void testCreatePolicyWithMultiplePermissions ()
+            throws IOException, URISyntaxException {
 
-	}
+        HttpClient httpClient = HttpClients.createDefault();;
 
-	private void checkResourceInDB(String id) throws KustvaktException {
+        String id = UUID.randomUUID().toString();
+        URIBuilder builder = new URIBuilder();
+        builder.setScheme("http").setHost("localhost").setPort(8089)
+                .setPath("/api/v0.1/admin/createPolicies/" + id)
+                .setParameter("type", "corpus").setParameter("name", "Brown")
+                .setParameter("description", "Brown corpus")
+                .setParameter("group", "public")
+                .setParameter("perm", Permission.READ.name())
+                .setParameter("perm", Permission.WRITE.name())
+                .setParameter("perm", Permission.DELETE.name())
+                .setParameter("loc", "255.255.255.0")
+                .setParameter("expire", "30D");
 
-		ResourceDao<?> dao = new ResourceDao<>(helper().getContext().getPersistenceClient());
-		assertEquals("sqlite", helper().getContext().getPersistenceClient().getDatabase());
+        URI uri = builder.build();
+        HttpPost httppost = new HttpPost(uri);
 
-		assertNotEquals(0, dao.size());
-		KustvaktResource res = dao.findbyId(id, User.UserFactory.getDemoUser());
-		assertNotNull(res);
-		Assert.assertEquals(true, res.getField("testVar").toString().startsWith("testVal_"));
-	}
+        httppost.addHeader(Attributes.AUTHORIZATION,
+                BasicHttpAuth.encode("kustvakt", "kustvakt2015"));
+        HttpResponse response = httpClient.execute(httppost);
+        assertEquals(ClientResponse.Status.OK.getStatusCode(),
+                response.getStatusLine().getStatusCode());
 
-	@Override
-	public void initMethod() throws KustvaktException {
-		// TODO Auto-generated method stub
+    }
 
-	}
+
+    @Test
+    public void testWrongAuthorization ()
+            throws IOException, URISyntaxException {
+        HttpResponse response = testResourceStore("wezrowerowj");
+        assertEquals(ClientResponse.Status.UNAUTHORIZED.getStatusCode(),
+                response.getStatusLine().getStatusCode());
+    }
+
+
+    @Test
+    public void testCorrectAuthorization ()
+            throws IOException, URISyntaxException, KustvaktException {
+
+        HttpResponse response = testResourceStore("kustvakt2015");
+        HttpEntity entity = response.getEntity();
+        String content = null;
+
+        if (entity != null) {
+            InputStream is = entity.getContent();
+            try {
+                content = IOUtils.toString(is, "UTF-8");
+            }
+            finally {
+                is.close();
+            }
+        }
+
+        assertEquals(ClientResponse.Status.OK.getStatusCode(),
+                response.getStatusLine().getStatusCode());
+
+        JsonNode node = JsonUtils.readTree(content);
+        assertNotNull(node);
+        assertTrue(node.isObject());
+        assertEquals("Goethe", node.path("name").asText());
+        assertEquals("Goethe corpus", node.path("description").asText());
+    }
+
+
+    public HttpResponse testResourceStore (String password)
+            throws IOException, URISyntaxException {
+
+        HttpClient httpclient = HttpClients.createDefault();
+        URIBuilder builder = new URIBuilder();
+        builder.setScheme("http").setHost("localhost").setPort(8089)
+                .setPath("/api/v0.1/virtualcollection")
+                .setParameter("filter", "httpclient")
+                .setParameter("name", "Goethe")
+                .setParameter("description", "Goethe corpus");
+        URI uri = builder.build();
+        HttpPost httppost = new HttpPost(uri);
+        httppost.addHeader(Attributes.AUTHORIZATION,
+                BasicHttpAuth.encode("kustvakt", password));
+        return httpclient.execute(httppost);
+
+    }
+
+
+    private void checkResourceInDB (String id) throws KustvaktException {
+
+        ResourceDao<?> dao = new ResourceDao<>(
+                helper().getContext().getPersistenceClient());
+        assertEquals("sqlite",
+                helper().getContext().getPersistenceClient().getDatabase());
+
+        assertNotEquals(0, dao.size());
+        KustvaktResource res = dao.findbyId(id, User.UserFactory.getDemoUser());
+        assertNotNull(res);
+        Assert.assertEquals(true,
+                res.getField("testVar").toString().startsWith("testVal_"));
+    }
+
+
+    @Override
+    public void initMethod () throws KustvaktException {
+        // TODO Auto-generated method stub
+
+    }
 }
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/full/PolicyServiceTest.java b/src/test/java/de/ids_mannheim/korap/web/service/full/PolicyServiceTest.java
index 6959924..c48f40c 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/full/PolicyServiceTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/full/PolicyServiceTest.java
@@ -15,6 +15,8 @@
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.interfaces.db.PolicyHandlerIface;
 import de.ids_mannheim.korap.interfaces.db.ResourceOperationIface;
+import de.ids_mannheim.korap.resources.Corpus;
+import de.ids_mannheim.korap.resources.Foundry;
 import de.ids_mannheim.korap.resources.KustvaktResource;
 import de.ids_mannheim.korap.resources.Permissions;
 import de.ids_mannheim.korap.resources.Permissions.Permission;
@@ -31,34 +33,36 @@
  */
 public class PolicyServiceTest extends FastJerseyTest {
 
-	@BeforeClass
-	public static void configure() throws Exception {
-		FastJerseyTest.setPackages("de.ids_mannheim.korap.web.service.full", "de.ids_mannheim.korap.web.filter",
-				"de.ids_mannheim.korap.web.utils");
-	}
+    private User user = UserFactory.getDemoUser();
 
-	@Test
-    public void testCreatePolicyForResource() throws IOException, KustvaktException {
-		String id = UUID.randomUUID().toString();
-    	ClientResponse response = resource()
-                .path(getAPIVersion())
-                .path("admin")
-                .path("createPolicies")
-                .path(id)
+
+    @BeforeClass
+    public static void configure () throws Exception {
+        FastJerseyTest.setPackages("de.ids_mannheim.korap.web.service.full",
+                "de.ids_mannheim.korap.web.filter",
+                "de.ids_mannheim.korap.web.utils");
+    }
+
+
+    @Test
+    public void testCreatePolicyForVirtualCollection ()
+            throws IOException, KustvaktException {
+        String id = UUID.randomUUID().toString();
+        ClientResponse response = resource().path(getAPIVersion()).path("admin")
+                .path("createPolicies").path(id)
                 .queryParam("type", "virtualcollection")
                 .queryParam("name", "Goethe VC")
                 .queryParam("description", "Goethe corpus")
                 .queryParam("group", "public")
                 .queryParam("perm", Permission.READ.name())
-                .queryParam("loc", "")
                 .queryParam("expire", "")
                 .header(Attributes.AUTHORIZATION,
-                        BasicHttpAuth.encode("kustvakt","kustvakt2015"))
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
                 .post(ClientResponse.class);
-        
+
         assertEquals(ClientResponse.Status.OK.getStatusCode(),
                 response.getStatus());
-        
+
         // Check the policies
         PolicyHandlerIface dao = helper().getContext().getPolicyDbProvider();
         List<SecurityPolicy> policies = dao.getPolicies(
@@ -66,18 +70,108 @@
                 Permissions.Permission.READ.toByte());
         assertEquals(2, policies.size());
         
-        // Check resource store
-        List<ResourceOperationIface> providers= (List<ResourceOperationIface>) helper().getContext().getResourceProviders();
-        ResourceOperationIface resourceDao = providers.get(0);
-        
-        User user = UserFactory.getDemoUser();
-		KustvaktResource resource = resourceDao.findbyId(id,user);
-		assertEquals("Goethe VC", resource.getName());
-        	
-	}
+        policies = dao.getPoliciesByPersistentId(
+                new PolicyCondition("public"), VirtualCollection.class,
+                Permissions.Permission.READ.toByte(),id);
+        assertEquals(1, policies.size());
+        assertEquals(id, policies.get(0).getTarget());
 
-	@Override
-	public void initMethod() throws KustvaktException {
-		helper().runBootInterfaces();
-	}
+        // Check the resource
+        List<ResourceOperationIface> providers = (List<ResourceOperationIface>) helper()
+                .getContext().getResourceProviders();
+        ResourceOperationIface resourceDao = providers.get(0);
+
+        User user = UserFactory.getDemoUser();
+        KustvaktResource resource = resourceDao.findbyId(id, user);
+        assertEquals("Goethe VC", resource.getName());
+
+    }
+
+
+    @Test
+    public void testCreatePolicyForFoundry ()
+            throws IOException, KustvaktException {
+        String id = UUID.randomUUID().toString();
+        ClientResponse response = resource().path(getAPIVersion()).path("admin")
+                .path("createPolicies").path(id).queryParam("type", "foundry")
+                .queryParam("name", "stanford")
+                .queryParam("description", "stanford parser")
+                .queryParam("group", "public")
+                .queryParam("perm", Permission.READ.name())
+                .queryParam("loc", "255.255.255.0")
+                .queryParam("expire", "30D")
+                .header(Attributes.AUTHORIZATION,
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .post(ClientResponse.class);
+
+        assertEquals(ClientResponse.Status.OK.getStatusCode(),
+                response.getStatus());
+
+        // Check the resource store
+        List<ResourceOperationIface> providers = (List<ResourceOperationIface>) helper()
+                .getContext().getResourceProviders();
+        ResourceOperationIface resourceDao = providers.get(0);
+        KustvaktResource resource = resourceDao.findbyId(id, user);
+        assertEquals("stanford", resource.getName());
+
+        // Check the policies
+        PolicyHandlerIface dao = helper().getContext().getPolicyDbProvider();
+        List<SecurityPolicy> policies = dao.getPoliciesByPersistentId(
+                new PolicyCondition("public"), Foundry.class,
+                Permissions.Permission.READ.toByte(),id);
+        assertEquals(1, policies.size());
+        assertEquals("255.255.255.0",policies.get(0).getContext().getIpmask());
+
+    }
+
+
+    @Test
+    public void testCreatePolicyForMultiplePermissions ()
+            throws IOException, KustvaktException {
+        String id = UUID.randomUUID().toString();
+        ClientResponse response = resource().path(getAPIVersion()).path("admin")
+                .path("createPolicies").path(id).queryParam("type", "corpus")
+                .queryParam("name", "Brown")
+                .queryParam("description", "Brown corpus")
+                .queryParam("group", "public")
+                .queryParam("perm", Permission.READ.name())
+                .queryParam("perm", Permission.WRITE.name())
+                .queryParam("perm", Permission.DELETE.name())
+                .queryParam("expire", "30D")
+                .header(Attributes.AUTHORIZATION,
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .post(ClientResponse.class);
+
+        assertEquals(ClientResponse.Status.OK.getStatusCode(),
+                response.getStatus());
+
+        // Check resource store
+        List<ResourceOperationIface> providers = (List<ResourceOperationIface>) helper()
+                .getContext().getResourceProviders();
+        ResourceOperationIface resourceDao = providers.get(0);
+
+        KustvaktResource resource = resourceDao.findbyId(id, user);
+        assertEquals("Brown", resource.getName());
+
+        // Check the policies
+        PolicyHandlerIface dao = helper().getContext().getPolicyDbProvider();
+        List<SecurityPolicy> policies = dao.getPoliciesByPersistentId(
+                new PolicyCondition("public"), Corpus.class,
+                Permissions.Permission.WRITE.toByte(),id);
+        assertEquals(1, policies.size());
+        assertEquals(id, policies.get(0).getTarget());
+        
+        policies = dao.getPoliciesByPersistentId(
+                new PolicyCondition("public"), Corpus.class,
+                Permissions.Permission.DELETE.toByte(),id);
+        assertEquals(1, policies.size());
+        assertEquals(id, policies.get(0).getTarget());
+    }
+
+
+    @Override
+    public void initMethod () throws KustvaktException {
+        helper().runBootInterfaces();
+    }
 }
+
diff --git a/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceServiceTest.java b/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceServiceTest.java
index d036b57..fed448d 100644
--- a/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceServiceTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/service/full/ResourceServiceTest.java
@@ -18,6 +18,7 @@
 
 import de.ids_mannheim.korap.config.Attributes;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.handlers.ResourceDao;
 import de.ids_mannheim.korap.query.serialize.QuerySerializer;
 import de.ids_mannheim.korap.resources.KustvaktResource;
@@ -301,7 +302,35 @@
                 User.UserFactory.getDemoUser());
         assertNotNull(res);
         Assert.assertEquals("Goethe",res.getName().toString());
-    
+        
+        // no update resource service
+        response = resource()
+                .path(getAPIVersion())
+                .path("virtualcollection")
+                .path(id)
+                .queryParam("name", "Goethe")
+                .header(Attributes.AUTHORIZATION,
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .post(ClientResponse.class);
+        
+        assertEquals(StatusCodes.NOTHING_CHANGED, response.getStatus());
+        
+        // update resource service
+        response = resource()
+                .path(getAPIVersion())
+                .path("virtualcollection")
+                .path(id)
+                .queryParam("name", "Goethe collection")
+                .header(Attributes.AUTHORIZATION,
+                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
+                .post(ClientResponse.class);
+        
+        res = dao.findbyId(id,
+                User.UserFactory.getDemoUser());
+        assertNotNull(res);
+        Assert.assertEquals("Goethe collection",res.getName().toString());
+        
+        
         // delete resource service
     	response = resource()
                 .path(getAPIVersion())
@@ -340,36 +369,6 @@
         assertEquals("WPD15", node.path("id").asText());
     }
 
-    
-
-//    @Test
-//    public void testCreatePolicyForResource() {
-//    	ClientResponse response = resource()
-//                .path(getAPIVersion())
-//                .path("admin")
-//                .path("createPolicies")
-//                .path(UUID.randomUUID().toString())
-//                .queryParam("type", "virtualcollection")
-//                .queryParam("name", "Goethe")
-//                .queryParam("description", "Goethe corpus")
-//                .queryParam("group", "public")
-//                .queryParam("perm", Permission.READ.name())
-//                .queryParam("loc", "")
-//                .queryParam("expire", "")
-//                .header(Attributes.AUTHORIZATION,
-//                        BasicHttpAuth.encode("kustvakt", "kustvakt2015"))
-//                .post(ClientResponse.class);
-//        
-//        assertEquals(ClientResponse.Status.OK.getStatusCode(),
-//                response.getStatus());
-//        
-//        String ent = response.getEntity(String.class);
-//        JsonNode node = JsonUtils.readTree(ent);
-//        assertNotNull(node);
-//        assertTrue(node.isObject());
-//        assertEquals("GOE", node.path("id").asText());
-//	}
-    
     @Test
     public void testCorpusGet2 () {
     	ClientResponse response = resource().path(getAPIVersion())